Passive scheme with photon-number-resolving detector for monitoring the untrusted source in 

Plug-and-Play quantum key distribution system 
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A passive scheme with a beam splitter and a photon-number-resolving (PNR) detector is proposed to verify 
the photon statistics of an untrusted source in a plug-and-play quantum-key-distribution system by applying a 
three-intensity decoy-state protocol. The practical issues due to statistical fluctuation and detection noise are 
analyzed. The simulation results show that the scheme can work efficiently when the total number of optical 
pulses sent from Alice to Bob is above 10 s , and the dark count rate of the PNR detector is below 0.5 counts/pulse, 
which is realizable with current techniques. Furthermore, we propose a practical realization of the PNR detector 
with a variable optical attenuator combined with a threshold detector. 

PACS numbers: 03.67.Dd, 03.67.Hk 



I. INTRODUCTION 

Based on the BB84 protocol flJJ] , the security analysis 
for the practical quantum-key-distribution (QKD) source was 
given jfl [H. Further, the decoy-state protocol was pro- 
posed [4] and was developed 1151-4 1 Oil to improve the QKD per- 
formance. Commonly, a trusted QKD source is considered 
for those protocols, which means the photon-number distribu- 
tion (PND) of the source is fixed and is known by Alice and 
Bob. However, this assumption is not always valid in prac- 
tice. For example, the intensity fluctuation from the source 
and the parameter fluctuation from the optical devices cause 
the assumption of the trusted source to fail 111 111 . In particular, 
an untrusted source exists in a real-life experiment (i.e., two- 
way plug-and-play system) and gives rise to the possibility of 
a Trojan-horse attack |l2Hlql . where the source is pessimisti- 
cally controlled by Eve. Thus, the statistical characteristics of 
the QKD source need to be verified to boost the QKD perfor- 
mance 1 1 2H26TI . 

Intuitively, if the characteristics of the untrusted source in- 
finitely approaches that of the trusted source, Alice needs 
a quantum nondemolition (QND) measurement [27] to ver- 
ify the PND of the QKD source. However, it is hard to 
implement the QND measurement in practice. Fortunately, 
an analytical method was provided to calculate the final key 
rate when the probability of untagged bits was known by 
Alice and Bob [13], and an active photon-number-analyzer 
(PNA) scheme was proposed to monitor the probability of un- 
tagged bits. However, it is challenging to implement the ac- 
tive scheme, where a high speed random optical switch and 
a perfect intensity monitor are needed. Then, using inverse- 
Bernoulli transformation, a passive scheme, with a beam split- 
ter (BS) and an imperfect detector, was proposed and was 
verified experimentally 111411 . Furthermore, to realize the pas- 
sive scheme more efficiently, a high-speed two-threshold de- 



tection can be used without applying inverse-Bernoulli trans- 
formation postprocessing IU5l Hal . From another viewpoint, 
recent results for the three-intensity decoy-state protocol with 
the untrusted source have rigorously proved that it is suffi- 
cient to monitor the lower and upper bounds of the probabil- 
ity for Alice to send out vacuum, one photon, and two photon 
states ( 1 9L l20fl . More recently, the detector-decoy scheme was 
theoretically proposed to monitor the PND of an untrusted 
source using a threshold detector combined with a variable 
optical attenuator (VOA) If22ll . 

In the following, a passive scheme with a BS and a 
photon-number-resolving (PNR) detector, which can discrim- 
inate vacuum, one-photon, two-photon, and more than two- 
photon states, is proposed to monitor the parameters needed 
in Refs. [ 19, 20]. Then, the untrusted source in the plug-and- 
Play QKD system can be monitored with the passive scheme. 
Additionally, some practical issues due to finite-data size and 
random-detection noise are included in the analysis. Further- 
more, a proposed realization of the PNR detector is analyzed 
based on the idea of the detector-decoy scheme If22tl . 



II. KEY PARAMETERS IN SECURITY ANALYSIS 



Generally, the secure key rate of the BB84 protocol is |0,[lt] 



R=lQ{Ai[l-H 2 ( ei )]-H 2 (E)}< 



(1) 



where Q and E are, respectively, the count rate and the quan- 
tum bit error rate (QBER) measured in the QKD experiment, 
Ai (ei) is the fraction of counts (QBER) due to the single- 
photon state, and H2(x) = -xlog 2 (x) - (1 - x)log 2 (l - x) is 
the binary Shannon entropy. In the standard security analysis 
of the BB84 protocol, all the losses and errors are assumed 
from the single-photon state yfl, which gives 
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where P mu iti is the probability for Alice to send out multipho- 
ton states. 
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The decoy-state method offers a more effective way to 
estimate the lower (upper) bound of A! (e\) compared to 
Irl jioll . In the three-intensity decoy-state protocol 
Alice randomly sends three kinds of sources: vac- 
uum, decoy, and signal sources, respectively. The quan- 
tum state of the decoy (signal) source is pd = Y^=o a n I") ("I 
(p s = 2,7=0 a ' n \ n ) ( n \y F° r a three-intensity decoy-state QKD 
system with an untrusted source, it was proved that [ 19, 20] 
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where Qq, Qd, or Q s is the count rate of vacuum, decoy, and 
signal sources, respectively, and AJ is the fraction of counts 
due to the single-photon state in the signal source. To calcu- 
late the lower bound of Aj, one needs to estimate the param- 
eters {a' Q L , Oq, a' x L , a u x , a' 2 L , a 2 ], where the superscript L{U) 
means lower (upper) bound. The secure key rate of the signal 
source is 



R s = l;QslA s Al-H 2 (e*)l-H 2 (E s )}, 



(4) 



where E s is the QBER from the signal source and <?* = E s /A s v 
In the following, we present a passive scheme to estimate the 
parameters {a' Q L , a%, a[ , a v x , a' 2 L , a 2 }. 



A. PNR detector without detection noise 

In the following, the PNR detector is assumed to be noise- 
less. Suppose that P s<d \ri4) denotes the PND for the signal 
(decoy) source at P4, and D s< - d \m) denote the PND for signal 
(decoy) source at P3. Clearly, one has 
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where n — 0, 1 , 2, • • • . 

Suppose that the data size N is the total number of optical 
pulses sent from Alice to Bob, while N'w is the number of 
signal (decoy) pulses, correspondingly. Let k^ d) denote the 
number of detected signal (decoy) pulses at P3 given that the 
PNR detector records m photoelectrons (ra = 0, 1,2). Using 
the random sampling theory [28], each D"(m) e [k s n JN s - 
s',k s m /N s + e'] with a confidence level 1 - 2 exp(-N s s' 2 /2) 
for signal pulses, and each D d (m) e [k^ n IN d - s,k d JN d + s] 
with a confidence level 1 - 2exp{-N d s 2 /2) for decoy pulses 
can be estimated. For enough small exp(-NV 2 /2) and 
exp(-A^ £/ e 2 /2), simultaneously, D s (m) e [k s JN s - s', k s JN s + 
e'] and D d (m) e [kf'jN' 1 - e,k d n /N d + e] for m = 0,1,2 
are estimated approximately with a confidence level 1 - 



III. THEORY OF ESTIMATION WITH PASSIVE SCHEME 



The passive scheme for estimating the parameters {a' Q , al 7 , 
a\ L , a 1 ^, a' 2 , a 2 ) is shown in Fig.Q] where a PNR detector that 
can discriminate the photon number of n = 0, n = 1, n = 2, 
and n > 3 is used. For simplicity, one can calibrate the setup 
to satisfy 



- Vbs) = rjBS, 



(5) 



where t/bs is the transmittance of the BS and rjo is the detec- 
tion efficiency of the PNR detector. Under this condition, the 
PND at P4 is the same as that at P3, where Pi means position 
i(i= 1,2, 3, 4) in Fig.Q] 
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FIG. 1: (Color online) The untrusted source prepared at PI by Eve, 
where Pi means position i (i = 1, 2, 3, 4), passes through an optical 
filter, a phase randomizer (PR), and an attenuator (Att) with the at- 
tenuation coefficient rj s (rjj) for the signal (decoy) source. After the 
source is encoded, a BS with transmittance rj BS separates it into two 
beams: One goes to a PNR detector with efficiency rj D at P3, and the 
other is sent out from Alice's side at P4. 
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FIG. 2: (Color online) Simulation results of the three-intensity 
decoy-state protocol for the trusted source with infinite-data size, and 
for the untrusted source with: (a) finite-data size N = 10 9 , 10 8 , 10 7 , 
respectively, based on the passive PNR scheme in Fig. 1, where a BS 
and a noiseless PNR detector are used to verify the parameters [a' Q L , 
Oq , a' { L , a v x , a' 2 , a^} with a confidence level 1 - 10~ 6 ; (b) finite- 
data size N = 10 16 , 10 14 , 10 12 , 10 10 , 10 9 , respectively, based on the 
passive PNA scheme fiUl . where a BS and noiseless PNA are used 
to verify the lower bound of the probability of untagged bits with a 
confidence level 1 - 1CT 6 (see Appendix A). 
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6 exp(-/VV 2 /2) - 6 exp(-N d s 2 /2). From Eq. ©, one simul- 
taneously gets 



N d 



+ s, (m = 0,1,2) 



(7) 



with a confidence level 1 -6 exp(—N s s' 2 /2)-6 exp(-N d s 2 /2). 

For testing the effects of the finite-data size, we choose an 
untrusted source of Poissonian statistics to perform simula- 
tions based on the three-intensity decoy-state protocol. Fig- 
ure[2f a) shows the numerical simulation results for the trusted 
source, and the untrusted source with the passive PNR scheme 
in Fig.Q] where a BS and a noiseless PNR detector are used to 
verify the parameters {a' Q L , a¥, a[ L , a u x , a' 2 L , a!^}. Here, the av- 
erage photon number (APN) of the Poissonian source at PI is 
7.69 xlO 6 . The attenuation T] s(d) is set to be 5 x 1(T 7 (1 x 1(T 7 ), 
and the transmittance of the BS is tjbs = 0.13 so that the APN 
for the signal (decoy) state at P4 is p. s - 0.5 (fid - 0.1). 
The detection efficiency of the PNR detector rjo is set to be 
0.15, so that Eq. (O holds. The photoelectron detection data 
recorded by the PNR detector is simulated using the Monte 
Carlo method, and N = 10 7 , 10 s , and 10 9 of measurements are 
run. Other experimental parameters are cited from the GYS 
experiment [29] as shown in Table [I] where rjBob is the effi- 
ciency of Bob's detection, Yq is the dark count rate of Bob's 
detector, and edet (<?o) is the probability that a photon (dark 
count) hits the erroneous detector on Bob's side. To compare 
the performance of the scheme in Fig.Q]with the passive PNA 
scheme proposed in Ref. [ 15], where a BS with transmittance 
tjbs and a noiseless PNA with efficiency rjo are used to verify 
the probability of untagged bits (see Appendix A), Fig. 2(b) 
shows the numerical simulation for the trusted source and the 
untrusted source with the passive PNA scheme. All the ex- 
perimental parameters are chosen to be the same as that for 
Fig. 2(a). 



B. PNR detector with additive detection noise 



Let kfjy denote the number of detected signal (decoy) pulses 
by Alice at P3 given that the PNR detector records m! pho- 
toelectrons. Using the random-sampling theory [28], simul- 
taneously, P s (m') e [k s m ,/N s - e',k* n ,/N s + s'] and P d (m') e 
\k d m ,IN d - e, k d m ,IN d + s] for m' = 0, 1,2 are estimated with a 
confidence level 1-6 exp(-7VV 2 /2) -6 exp(-N d s 2 /2). Com- 
bining Eqs. © and (O, one yields 
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with a confidence level 1-6 exp(-7V ! e' 2 /2)-6 exp(-N d s 2 /2) 



(9) 



TABLE I: The simulation parameters for Figs.[2][3]and[6] 





rjBS 


llBob 
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edet 


eo 


0.15 


0.13 


0.045 


0.21 


1.7 x 10-" 


3.3% 


0.5 



Given a PNR detector with an independent additive detec- 
tion noise y, the detected photoelectron number m', and the 
photon number m at P3 satisfy m' — m +y. One can calculate 
the lower and upper bounds of PND D(m) (m — 0,1,2) at P3 
based on the detected photoelectron distribution P(m') , given 
that the distribution of the detection noise N(y) is known by 
Alice and independent of the input source. The dark count is 
the main kind of detection noise for the PNR detectors, such 
as the time multiplexing detector ll30l[3lll . the transition-edge 
sensor [32], or a threshold detector together with a variable 
Att ll22l |3 3h . In the case of independent Poissonian statis- 
tics noise, the probability of detecting m! photoelectrons is 
p ( m ') = i^=oN{d)D(m' - d), where N(y = d) = e~ x X d ld\ is 
the probability that d dark counts occur in the PNR detector, 
and A is the average dark count rate. Then, one has 
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For testing the effects of detection noise, we choose an un- 
trusted source of Poissonian statistics to perform simulations 
based on the three-intensity decoy-state protocol with the pas- 
sive PNR scheme in Fig.Q] The untrusted source is of Poisso- 
nian statistics with APN p - 7.69 x 10 6 at PI, and the attenua- 
tions rj s and rid are set to be 5 x 10~ 7 and 1 x 10~ 7 , respectively. 
The other experimental parameters are cited from Table I. The 
photoelectron detection and additive Poissonian noise of the 
PNR detector are simulated using the Monte Carlo method, 
and /V = 10 8 and 10 9 of measurements are run for Figs. [3 a) 
and [3jb), respectively. Our analysis is not limited to the Pois- 
sonian noise case. Generally, when the random-positive de- 
tection noise y with the probability N(y) is known to Alice, 
one has 



P(m' = 0) 
P(m' = 1) 
P(m' = 2) 



D(m = 0) 
D(m = 1) D(m = 0) 
D(m = 2) D(m = 1) D(m = 0) 
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Thus, combining the results in Eqs. (6) and (10), one has 

fl °- N(y = 0) ' 

(k s m ,JN s - s') N(y = 0) - (k s m , ={) /N s + s') N(y = 1) 
fl ' " JV 2 (y = 0) ' 

.l&^/N'-er k>, =1 /N' + e> 



N(y = 0) 
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k d , JN d + s „ li?, JN d -s 
+ r— N 2 {y=\)-^r —N(y = 2). (11) 



N 3 (y = 0) 



N 2 (y = 0) 



Therefore, once the distribution of the detection noise is 
known, the secure key rate can be estimated given the bounds 
of {a' L , cIq, a'j L , a u x , a' 2 L , a^}. 



IV. A PROPOSED REALIZATION OF A PNR DETECTOR 

The PNR detector can be realized by a VOA (VOA) com- 
bined with a practical threshold detector as shown in Fig. 4(a) 
dlH, which is equivalent to the model in Fig. 4(b). Sup- 
pose that the state of input source is p,„ = YjZ=oPn\n){n\. 
In figure 4(b), after passing through an Att with efficient rjo, 
the state of the source becomes p' = Yi™=o Pn \ n ) ( n \ > wnere 

Pn = Zm=nPm ( * ~ ^) m ~" When Eq. © holds, one 

has 



Pn = a m Pn 



(12) 



Then, the source passes through the VOA with efficiency 77, 
and the probability that the detector dose not click can be cal- 
culated as p(rj) = 2,tLo(l ~ T i) n p' n 112211 . When we take the dark 
count of the threshold detector into account, it can be calcu- 
lated as p{rf) — (1 - A) Y^=o(^ ~ n) n Pn< wnere A is me dark 
count rate of the detector. If Alice varies the transmittance of 
the VOA 77 € {771, • • • ,77m}, she has a set of linear equations, 



p{r }i ) = (\-X)Y J (l-r }i ) n p' n , (7 = 1, 



,M). 



(13) 



n=0 



When she employs an infinite number of possible transmit- 
tance 77 € [0, 1], she can always estimate any finite number of 
probabilities p' n with arbitrary precision by solving Eqs. ( fT3l l. 
However, it is not necessary for our purpose in which we 
are mainly concerned with the probability of vacuum, one- 
photon, and two-photon states, and, thus, only three different 
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FIG. 3: (Color online) Simulation result of the three-intensity decoy- 
state QKD with an untrusted source based on the scheme in Fig. 1: 

(a) The data size is N = 10 s , and the APN of the Poissonian noise in 
the PNR detector is A = 0, KT 6 , 10 -1 , 0.5, 0.65, 0.78, respectively; 

(b) the data size is N = 10 9 , and the APN of the Poissonian noise in 
the PNR detector is A = 0, 10~ 6 , 10"\ 1, 5, 5.16, respectively. The 
experimental parameters are the same as in Table I. The confidence 
level for both cases is 1 - 10~ 6 . 
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FIG. 4: (Color online) (a) A threshold detector (modeled by an Att 
with transmittance r] D and an ideal threshold detector) combined with 
a VOA (transmittance: rf) can realize a PNR detector 12211 . (b) An 
equivalent model to (a), which means the two models will produce 
the same output given the same input. 



transmittances 77 € {770, 771, 772} are needed [22]. One can 
choose 770 = 1, 



pirn = 1) = (1 - X)p' Q . 



(14) 



Then one has 

pirn) 



1 - A 

p(m) 

1 - A 



>p' + (i -m)p[> 
< p'o + (i - m)p\ + (i - >/i) 2 a - p'o - p'i), 



from which one gets 



, . p(m)-p(m) — , . pirn) - Mi - d - ?7i) 2 ] - d - jXj - , „~ 
* 7,1 " (i - - 771 - (i - 771) 2 ] = ^ (15) 

In a similar way, one has 

fzj ^/>o + d - m)p\ + (i - mfp'i >p' + (i- m)p\_ + d - 72) 2 /> 2 

< Po + (1 - ^P'j + (1 - lfe)V 2 + (1 - ^2) 3 (P3 + P'a + Ps + ■ ■ ■ ) 

I — A 

< [i - (i - mf]p' + [i-^-(i- '?2) 3 ]p[ + [(l - mf - (l - mf]p' 2 + (i - m)\ 

from which the upper and lower bounds for pi, can be estimated as 

p(m) - pino) - (i - A)(i - 772)^1 _ 

^" (l-^)(l-772) 2 = = ^ 

, p^-ti-a-^M^-ci-Axi-ift-a-i^Vi-d-^d-^) 3 , 

(1 - - 772) 2 - (1 - 772) 3 ] — 



In conclusion, based on the recorded data {p(t]q), p(r)\), 
p(i]2)}, Ahce can estimated the parameters {a' () L , a%, a' x L , 
a x , al L , a"} as in Eqs. (O and ([T^J - ([T6j . The scheme in 
Fig. |4]can easily be realized with current technology. As for 
the effect of statistical fluctuation, one can use the random- 
sampling theory as before to consider the fluctuation of the 
ipino)' Pi^i)' Pill)} with a confidence level so that we still 
can bound {a' L , aF, a\ L , a\, a' 2 L , a^}- 



V. DISCUSSION AND CONCLUSION 

The results in Fig. [2] show that: (i) The performance of a 
QKD system with an untrusted source is close to that of a 
trusted source, when the source is monitored efficiently and 
the data size is large enough; (ii) finite-data size has negative 
effect on the secure key rate; (iii) the method in Ref. IU5I1 is 
more sensitive to statistical fluctuation and needs a larger data 
size than the method proposed in this paper. 

In the passive PNA scheme proposed in Ref. [15] (see Fig. [5] 
in Appendix A), Alice uses a PNA to monitor the probability 
of the untagged bits in the untrusted source, after which, one 
can estimate the lower bound of the secure key rate with a 
confidence level as shown in Eq. ( 1AU . When the confidence 
level is set to be constant (e.g., 1 - 10~ 6 ), the estimation reso- 
lution e for the probability of untagged bits is only decided by 
the data size N (ignoring the effect of detection noise), where 
the confidence level is 1 - 2 exp(-Ns 2 /4) lfl5ll . However, the 
secure key rate in Ref. fl5ll is sensitive to the estimation reso- 
lution e, and will reduce greatly when e increases (see Fig. [6] 
in Appendix A). When the data size decreases, the resolu- 
tion s has to increase to keep the constant confidence level, 



and, thus, the key rate will reduce. 

While in the scheme shown in Fig.Q] Alice uses a PNR de- 
tector to monitor the probability of vacuum, one-photon, and 
two-photon states for the signal and decoy sources, respec- 
tively. Because of the low intensity of the output pulses at P4 
(e.g., p. s = 0.5, fid = 0.1), the vacuum, one-photon, and two- 
photon pulses are dominant in pulses, and Alice can gain most 
of the information about the statistics of the untrusted source 
at P4 based on the recorded data of the PNR detector. In our 
scheme, six parameters are monitored, and more information 
is gained than from the scheme in Ref. 01511 . Mathematically, 
the formulas shown by Eq. © are not so sensitive to the esti- 
mation resolution of {a' Q L , a^, a' x L , af, a' 2 L , a^} compared to 
that in Ref. lfl5ll so that it does not require a very large data 
size to work efficiently, as shown in Fig. 2(a). When the data 
size is N > 10 8 , the performance of the scheme is very close 
to that of the trusted source. In the asymptotic case where 
Alice sends infinitely long bits of sequence (N ~ 00), the per- 
formance will be the same as that of a trusted source as shown 
in Appendix B. 

The results in Fig. [3] show that: (i) Given a PNR detector 
with the same dark count rate, the performance of a system 
with an untrusted source will be better when the data size in- 
creases; (ii) given the same data size, the performance of a 
system with an untrusted source will reduce when the dark 
count rate increases. The performance of the scheme in Fig.Q] 
is quite sensitive to the detection noise of the PNR detector. 
It is shown that when the data size is N > 10 8 and the dark 
count rate of the PNR detector is A < 0.5 counts/pulse, which 
are realizable by current techniques [30-33], this scheme can 
still work efficiently. 

In conclusion, we propose an experimental scheme to verify 
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the key parameters needed in Refs. lfl9l l20ll . The practical is- 
sues due to detection noise and finite-data-size fluctuation are 
analyzed. We also propose a realization of the PNR detector 
based on the detector-decoy method, which is very practical 
in real experiment. Therefore, the passive scheme with a PNR 
detector is highly practical to solve the untrusted source prob- 
lem in the two-way plug-and-play QKD system. This passive 
scheme is also applicable to monitor the intensity fluctuation 
in a one-way QKD system, where an active scheme has been 
proposed and has been tested experimentally If26ll . 

We remark that the effect of parameter fluctuations has 
not yet been included in the security analysis. The effective 
method to deal with the parameter fluctuations [19] is encour- 
aged to be applied in the passive scheme. 
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Appendix A: Passive scheme method in fi^l 




Bob 



FIG. 5: (Color online) The model of the passive PNA scheme in 
Ref. 114-161. The untrusted source prepared by Eve passes through 
an optical filter and a PR. Then, a BS with transmittance rj B s sepa- 
rates it into two beams: One goes to a PNA with efficiency rj D , and 
the other is attenuated by an Att with efficiency tj^ for the signal 
(decoy) state and is encoded before being from sent out of Alice's 
side. 
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FIG. 6: (Color online) Simulation result of the three-intensity decoy 
state protocol for the trusted source and the untrusted source with 
different estimation resolutions s = 10~ 6 , 10~ 5 , 10~ 4 , respectively. 
Based on the passive PNA scheme in Fig. [5] a BS and a noiseless 
PNA are used to verify the lower bound of the probability of un- 
tagged bits. Experimental parameters are cited from Table|I] 



are untagged bits with a confidence 1-2 exp(-A^e 2 /4) where 
e is a small positive parameter itlSll . 

Alice can measure the overall gain Q s (d) and the QBER 
E S (d) for signal (decoy) pulses, respectively, while she does 
not know the gain and the QBER for the untagged bits. The 
upper and lower bounds of the gain of the untagged bits for 
the signal (decoy) source can be estimated as 



Qs(d) 



Qs(d) 



l-A-s 



Q s(d) = max \ 0. 



Q s(d) - A - g 
1 - A-e 



The upper and lower bounds for the QBER of the untagged 
bits can be estimated as 



Q S E S 



QsE s 



l-A-s 
for signal states, and 
QdE d 



Q S E S = max -! 



QdEd 



1 - A 



Q d E d = max < 



Q S E S - A - e 

1 -A-£ 



QdEd- A- e) 
l-A-s I 



for decoy states. For the untagged bits, one can show that 
the upper and lower bounds of the probability that the output 
photon number at position 4 is n for signal (decoy) pulses are 



The passive PNA scheme in Ref. 11511 is shown in Fig. [5] 
For simplicity, one can set rjo(l - t]bs) = t]bs so that the PND 
at position 2 is the same as that at position 3 in Fig. [5] Define 
the pulses, whose photon number is M e [M m ; n , M max ] at po- 
sition 3, as untagged bits. A BS and a PNA are used to record 
the frequency of untagged bits experimentally. 

Suppose that pulses are sent from Alice to Bob. Al- 
ice and Bob do not know which bits are untagged bits. Let 
Nuntagged denote the number of detected pulses by the PNA 
when the recorded photoelectron number at position 2 belongs 
to [M m ; n , M max ], and A = N unla g ge dlN. From the recorded data 
in the PNA, one can estimate that at least (1 - A - £)A^ pulses 



jS(d) 



(1 - rj s{ d)) 

o 



(i - ns(d)) 

M, 

n ) ''"(d) 





under the condition M md ,yj] s ^) < 1 ■ 



n = 0, 

1 < n < M miX: 
n > M max , 

n = 0, 

1 < n < M min , 
n > M mia , 



7 



When the lower bounds of the probability of the untagged 
bits are known by Alice, the secure key rate for the three- 
intensity decoy-state protocol with an untrusted source is lfl3ll 



H 2 (E S ) + (1 - A - s)Q\[\ - H 2 {e[)] , (Al) 



The estimation resolution e is only decided by the data size 
N. When the data size N decreases, the resolution s has to 
increase to keep the constant confidence level, and, thus, the 
key rate will reduce greatly as shown in Fig. 2(b). 



where 



p s 

Q\ = — — — x \Q d P s 2 - WsPi + P S oP(Qo- 

pd us ps pd \ — 



and 



pd ps _ ps pi 
r l r 2 r l r 2 



P d P s 2 Qo 



MminXl -T] d ) 



M m „-M mi „-l 



[M min + 1]! 



Appendix B: Asymptotic case of method in 1 19] 

In the asymptotic case, Alice sends the infinitely long bits 
sequence (N ~ oo). Therefore, one can consider e, s' ~ 
in Eqs. (O, ©, or (fTTT i while still having the confidence level 
1. Suppose that the PND of the untrusted source is Poisso- 
nian with an APN of (x s (d) for the signal (decoy) source at P4 
in FigQ] One has 



_ E s Q s -P^E Qo 

For testing the effects of s onto the secure key rate, we choose 
an untrusted source of Poissonian statistics to perform the 
simulations based on the three-intensity decoy-state protocol. 
Suppose that the untrusted source has Poissonian PND with an 
APN of 7.69 x 10 6 at position 1 of Fig. 5. Set rj s = 5 x 1(T 7 , 
and rjd = 1 x 10~ 7 . The other experimental parameters are 
chosen to be the same as in Table I. The values of M max and 
Mmin are chosen to be constant. The results in Fig. 6 show that 
the final key rate is very sensitive to the value of e. 

Suppose that Alice has a noiseless PNA, and the estimation 
confidence level is set to be constant 



fi d e 



-in n u 



', A] = Us 



Then, one can estimate 



a 2 =-e»* 



< (a' 2 L Q d - a u 2 Q s - a' 2 L a u Q Q + a^a' L Q ) 



1 _ 2e- Afe2/4 = 1-10- 



(A2) which is exactly the same as the case for a trusted source. 
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